Dan Goodin

Reporter covering security at Ars Technica. DM me on Signal: DanArs.82.

Site:: https://arstechnica.com/author/dan-goodin/

Public Key

npub1z3lwfekw80j4ngzg6ky3ks202xr6uwnd4jttxzsd4euc9l55euvq48qvzu

NIP-05 Address

dangoodin_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqspglhyum8rhe2e5pydtzgmg984rpaw8fk6e94npgx6u7vzl62v7xqwkcvwe

Author Public Key

npub1z3lwfekw80j4ngzg6ky3ks202xr6uwnd4jttxzsd4euc9l55euvq48qvzu

Show more details

Last Notes

2024-08-29 21:10:12

Can anyone tell me what these notations, left by construction workers on a San Francisco street, mean?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/047/358/201/021/176/original/82895cdc2932e603.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/047/358/737/773/524/original/08206b8abbdbd089.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/047/359/253/018/451/original/d92591c872f90bb3.jpeg

2024-08-28 01:55:41

A source with knowledge of the incident said the cemetery official tried to prevent Trump staffers from filming and photographing in a section where recent U.S. casualties are buried. The source said Arlington officials had made clear that only cemetery staff members would be authorized to take photographs or film in the area, known as Section 60.
When the cemetery official tried to prevent Trump campaign staff from entering Section 60, campaign staff verbally abused and pushed the official aside, according to the source.
https://www.npr.org/2024/08/27/nx-s1-5091154/trump-arlington-cemetery

2024-08-26 17:44:17

I want to create a list of smartphone apps that use HTTP to transmit data, especially data like geolocation and device information. Can anyone point to any?

2024-08-22 22:27:20

- reply

The problem here was that Google completely killed Support for this OS with zero notice. Google's own website said 128 supported 18.04. Some folks aren't able to switch browsers very quickly, for all kinds of legitimate reasons. Google has an obligation to give notice before removing Support to an OS that is still widely used.

2024-08-22 20:22:54

- reply

Update: Google just sent me the following:
"We recognize we caught some in the ecosystem off guard by this, and have decided to reverse the change and maintain support for Ubuntu 18.04. We will publish a build that restores compatibility next week. We do plan to drop support for 18.04 in the future, but will be sure to provide additional notice ahead of any changes."
Google spox also told me no other OSes were impacted by 128.

2024-08-22 19:38:22

@npub1lq6…nf7e has discovered that Chrome 128, released in the past 24 hours, no longer works on Ubuntu 18.04, a release that Canonical is supporting until 2028. Can anyone point me to Chrome 128 not working on other OS versions still in support?
(Please boost.)

2024-08-21 01:08:09

Last Tuesday, loads of Linux users—many running packages released as early as this year—started reporting their devices were failing to boot. Instead, they received a cryptic error message that included the phrase: “Something has gone seriously wrong.”
The cause: an update Microsoft issued as part of its monthly patch release. It was intended to close a 2-year-old vulnerability in GRUB, an open source boot loader used to start up many Linux devices. The vulnerability, with a severity rating of 8.6 out of 10, made it possible for hackers to bypass secure boot. CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday.
https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/

2024-06-19 05:11:39

- reply

Yeah, I'm looking forward to reading your research too.

2024-06-12 16:09:16

- reply

I didn't know the cryptobros could be any more toxic than I already thought, but this post has disabused me of that.

2024-06-12 16:01:29

From @npub1lhf…779l of @npub1pz8…np0r:
https://sfstandard.com/opinion/2024/06/12/opinion-crypto-bros-trump-fundraiser/
By framing Trump as the crypto candidate (as opposed to something else), the right hopes to unlock millions in donations from Bitcoin billionaires and NFT moguls who sold at the top of the market. In return, the crypto bros expect a president who will slash regulation and thus reduce the risk of their peers becoming bunkmates with Sam Bankman-Fried.
...
The truth is, what we’re seeing is not a change in Valley politics but a shift in power and attention away from the kind of leaders and companies who would sign a letter opposing Trump, towards the kind who would do whatever it takes to elect the guy who will keep their pals out of jail. An industry that once elevated innovators and mavericks today elevates grifters and jailbirds.

2024-06-08 03:17:01

The damage resulting from Orange Felon retaking the White House will be unprecedented and irreparable, with less privileged people disproportionately paying the price. It's beyond me how anyone considering themselves left of center isn't doing everything in their power (including voting for Biden) to head off this train wreck.
https://www.nytimes.com/interactive/2024/06/07/us/politics/trump-policy-list-2025.html?unlocked_article_code=1.yE0.HGUJ.n4G0j7au9_es&smid=url-share

2024-06-05 16:02:47

The Linux Kernel project was made an official CVE Numbering Authority (CNA) with exclusive rights to issue CVE identifiers for the Linux kernal in February this year.
While initially this looked like good news, almost three months later, this has turned into a complete and utter disaster.
Over the past months, the Linux Kernel team has issued thousands of CVE identifiers, with the vast majority being for trivial bug fixes and not just security flaws.
Just in May alone, the Linux team issued over 1,100 CVEs, according to Cisco's Jerry Gamblin—a number that easily beat out professional bug bounty programs/platforms run by the likes of Trend Micro ZDI, Wordfence, and Patchstack.
https://news.risky.biz/risky-biz-news-the-linux-cna-mess/

2024-06-05 00:14:05

During a routine visit with my MD today, he asked if it would be OK for our session to be recorded by an AI system to streamline the taking of notes and follow ups. I politely declined. I got the impression I'm the first patient who has told him this. I don't have any specific scenario I'm envisioning. I just get a bad feeling. Am I just being paranoid?

2024-05-27 18:28:01

@npub1uu7…gs7t
Prediction: if Trump retakes the White House these people will have a horror far graver than disaster fatigue set upon them.

2024-05-27 16:47:18

If you're mad at Biden for his policies toward Israel/Gaza, you will be absolutely apoplectic if Trump retakes the White House.
https://www.washingtonpost.com/politics/2024/05/27/trump-israel-gaza-policy-donors/

2024-05-23 23:08:25

A software maker serving more than 10,000 courtrooms throughout the world hosted an application update containing a hidden backdoor that maintained persistent communication with a malicious website, researchers reported Thursday, in the latest episode of a supply-chain attack.
The software, known as the JAVS Viewer 8, is a component of the JAVS Suite 8, an application package courtrooms use to record, play back, and manage audio and video from proceedings. Its maker, Louisville, Kentucky-based Justice AV Solutions, says its products are used in more than 10,000 courtrooms throughout the US and 11 other countries. The company has been in business for 35 years.
Researchers from security firm Rapid7 reported that a version of the JAVS Viewer 8 available for download on javs.com contained a backdoor that gave an unknown threat actor persistent access to infected devices. The malicious download, planted inside an executable file that installs the JAVS Viewer version 8.3.7, was available no later than April 1, when a post on X (formerly Twitter) reported it. It’s unclear when the backdoored version was removed from the company’s download page. JAVS representatives didn’t immediately respond to questions sent by email.
https://arstechnica.com/security/2024/05/crooks-plant-backdoor-in-software-used-by-courtrooms-around-the-world/

2024-05-23 17:26:23

For more than four days, a server at the very core of the Internet’s domain name system was out of sync with its 12 root server peers due to an unexplained glitch that could have caused stability and security problems worldwide. This server, maintained by Internet carrier Cogent Communications, is one of the 13 root servers that provision the Internet’s root zone, which sits at the top of the hierarchical distributed database known as the domain name system, or DNS.
Given the crucial role a root server provides in ensuring one device can find any other device on the Internet, there are 13 of root servers geographically dispersed all over the world. Normally, the 13 root servers—each operated by a different entity—march in lockstep. When a change is made to the contents they host, it generally occurs on all of them within a few seconds or minutes at most.
Strange events at the C-root name server
This tight synchronization is crucial for ensuring stability. If one root server directs traffic lookups to one intermediate server and another root server sends lookups to a different intermediate server, the Internet as we know it could collapse. More important still, root servers store the cryptographic keys necessary to authenticate some of intermediate servers under a mechanism known as DNSSEC. If keys aren’t identical across all 13 root servers, there’s an increased risk of attacks such as DNS cache poisoning.
For reasons that remain unclear outside of Cogent—which declined to comment for this post—the c-root it’s responsible for maintaining suddenly stopped updating on Saturday. Stéphane Bortzmeyer, a French engineer who was among the first to flag the problem in a Tuesday post, noted then that the c-root was three days behind the rest of the root servers.
https://arstechnica.com/security/2024/05/dns-glitch-that-threatened-internet-stability-fixed-cause-remains-unclear/

2024-05-23 02:44:09

Last summer, two years after an upside-down American flag was flown outside the Virginia home of Justice Samuel A. Alito Jr., another provocative symbol was displayed at his vacation house in New Jersey, according to interviews and photographs.
This time, it was the “Appeal to Heaven” flag, which, like the inverted U.S. flag, was carried by rioters at the Capitol on Jan. 6, 2021. Also known as the Pine Tree flag, it dates back to the Revolutionary War, but largely fell into obscurity until recent years and is now a symbol of support for former President Donald J. Trump, for a religious strand of the “Stop the Steal” campaign and for a push to remake American government in Christian terms.
https://www.nytimes.com/2024/05/22/us/justice-alito-flag-appeal-to-heaven.html

2024-05-15 17:18:39

Infrastructure used to maintain and distribute the Linux operating system kernel was infected for two years, starting in 2009, by sophisticated malware that managed to get a hold of one of the developers’ most closely guarded resources: the /etc/shadow files that stored encrypted password data for more than 550 system users, researchers said Tuesday.
The unknown attackers behind the compromise infected at least four servers inside kernel.org, the Internet domain underpinning the sprawling Linux development and distribution network, the researchers from security firm ESET said. After obtaining the cryptographic hashes for 551 user accounts on the network, the attackers were able to convert half into plaintext passwords, likely through password-cracking techniques and the use of an advanced credential-stealing feature built into the malware. From there, the attackers used the servers to send spam and carry out other nefarious activities. The four servers were likely infected and disinfected at different times, with the last two being remediated at some point in 2011.
An infection of kernel.org came to light in 2011, when kernel maintainers revealed that 448 accounts had been compromised after attackers had somehow managed to gain unfettered, or “root,” system access to servers connected to the domain. Maintainers reneged on a promise to provide an autopsy of the hack, a decision that has limited the public’s understanding of the incident.
In 2014, ESET researchers said the 2011 attack likely infected kernel.org servers with a second piece of malware they called Ebury. The malware, the firm said, came in the form of a malicious code library that, when installed, created a backdoor in OpenSSH that provided the attackers with a remote root shell on infected hosts with no valid password required. In a little less than 22 months, starting in August 2011, Ebury spread to 25,000 servers. Besides the four belonging to the Linux Kernel Organization, the infection also touched one or more servers inside hosting facilities and an unnamed domain registrar and web hosting provider.
A 47-page report summarizing Ebury's 15-year history said that the infection hitting the kernel.org network began in 2009, two years earlier than the domain was previously thought to have been compromised. The report said that since 2009, the OpenSSH-dwelling malware has infected more than 400,000 servers, all running Linux except for about 400 FreeBSD servers, a dozen OpenBSD and SunOS servers, and at least one Mac.
https://arstechnica.com/security/2024/05/ssh-backdoor-has-infected-400000-linux-servers-over-15-years-and-keeps-on-spreading/

2024-05-02 04:16:54

A second Boeing whistleblower has died. Josh Dean, a former mechanical engineer and quality auditor at Spirit AeroSystems, had flagged a manufacturing defect in a pressure bulkhead of the 737 MAX. He died Tuesday, two weeks after suddenly taking ill, being intubated and confined to the ICU. He filed a formal complaint against Boeing last year.
Dean's death comes two months after a separate Boeing whistleblower was found dead in his car from a gunshot wound to the head. John Barnett was due to appear for day 3 of depositions but never showed. His body, and a gun in his hand, were eventually found in a parking garage. I'm not aware of any surveillance video showing him driving there that day.
Are these deaths coincidences? A diabolical conspiracy? Either seems entirely plausible to me.
https://www.seattletimes.com/business/whistleblower-josh-dean-of-boeing-supplier-spirit-aerosystems-has-died/

2024-04-15 20:56:04

Every version of PuTTY released over the past 7 years contains a critical vulnerability that allows for the recovery of certain types of secret encryption keys, specifically 521-bit ECDSA. An adversary in possession of a “few dozen signed messages” and the public key can recover the private key. I’m curious to know how widely this vulnerability is likely to be felt. I’m guessing most people have already replaced keys with only 512 bits, which I’m further guessing are already susceptible to factorization. Can anyone confirm or disabuse me of these guesses?
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.html

2024-04-12 19:09:36

- reply

If only there was a way for companies like Apple to give their customers useful, actionable guidance so they didn't have to assume. If only.

2024-04-12 16:42:54

by [@briankrebs](https://infosec.exchange/@briankrebs)
Sisense declined to comment when asked about the veracity of information shared by two trusted sources with close knowledge of the breach investigation. Those sources said the breach appears to have started when the attackers somehow gained access to the company’s Gitlab code repository, and in that repository was a token or credential that gave the bad guys access to Sisense’s Amazon S3 buckets in the cloud.
Customers can use Gitlab either as a solution that is hosted in the cloud at Gitlab.com, or as a self-managed deployment. KrebsOnSecurity understands that Sisense was using the self-managed version of Gitlab.
Both sources said the attackers used the S3 access to copy and exfiltrate several terabytes worth of Sisense customer data, which apparently included millions of access tokens, email account passwords, and even SSL certificates.
The incident raises questions about whether Sisense was doing enough to protect sensitive data entrusted to it by customers, such as whether the massive volume of stolen customer data was ever encrypted while at rest in these Amazon cloud servers.
It is clear, however, that unknown attackers now have all of the credentials that Sisense customers used in their dashboards.
https://krebsonsecurity.com/2024/04/why-cisa-is-warning-cisos-about-a-breach-at-sisense/

2024-04-12 15:51:45

Kudos to [@marcan](https://social.treehouse.systems/@marcan) for finding a "chicken bit" in Apple's M2 and M1 chips that disables DMP, the optimization that leaks secret encryption keys. This is significant. A couple caveats, though:
-- This isn't officially supported, or even documented anywhere, by Apple. It appears to turn off the DMP but no one knows (yet) what else it might turn off.
-- This can only be done on Linux, at least for now. There's no known way for MacOS to support using these bits.
https://infosec.exchange/@marcan@treehouse.systems/112238390873024938

2024-04-08 19:10:59

Hackers are actively exploiting a pair of recently discovered vulnerabilities to remotely commandeer network-attached storage devices manufactured by D-Link, researchers said Monday.
Roughly 92,000 devices are vulnerable to the remote takeover exploits, which can be remotely transmitted by sending malicious commands through simple HTTP traffic. The vulnerability came to light two weeks ago. The researcher said they were making the threat public because D-Link said it had no plans to patch the vulnerabilities, which are present only in end-of-life devices, meaning they are no longer supported by the manufacturer.
https://arstechnica.com/security/2024/04/hackers-actively-exploit-critical-remote-takeover-vulnerabilities-in-d-link-devices/

2024-04-06 23:40:03

The scheme began at a hot dog stand in 1988.
Over the next three decades, Matthew David Keirans would trade places with William Donald Woods, steal his identity and send Woods down a path to spend more than 400 days in jail.
On Monday, Keirans pleaded guilty to identity theft, admitting to using the false name in “every aspect of his life.” He now faces up to 32 years in federal prison.
https://www.washingtonpost.com/nation/2024/04/06/identity-theft-puts-victim-in-jail/

2024-03-25 17:38:51

Today, the DoJ charged 7 alleged members of China-backed APT31with hacking a bunch of different companies. Among others, the targets include:
-- "a leading American manufacturer of
software and computer services based in California"
-- a "leading global provider of wireless technology based in Illinois"
-- a "software company
servicing the industrial controls industry based in California"
-- an "IT services and spatial processing company based in Colorado"
-- a "multi-factor
authentication company"
Any guesses who these unnamed targets are? I'm particularly interested in the MFA company. Seems like Authy, Okta, and LastPass are obvious guesses.
Seems like Motorola might be the Illinois-based wireless technology provider.
Who has educated guesses they want to share?
https://www.justice.gov/opa/media/1345141/dl?inline
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/157/510/274/913/693/original/0d526a1015948359.png

2024-03-23 20:12:35

[@kimzetter](https://infosec.exchange/@kimzetter)'s coverage of the GoFetch side channel is easier to understand than the article I did. It also digs into practical considerations of the vulnerability. Well worth the read.
https://www.zetter-zeroday.com/apple-chips/

2024-03-23 00:20:53

- reply

Here's an exclusive preview of [@0xdaeda1a](https://infosec.exchange/@0xdaeda1a)'s talk, though I have it on good authority that Cloud is older now.
***Update*** Sorry, that's Prem.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/142/127/751/334/252/original/cbb59205d11eda0a.mp4

2024-03-22 20:08:08

The lineup at [@hacks4pancakes](https://infosec.exchange/@hacks4pancakes)' [@pancakescon](https://infosec.exchange/@pancakescon) looks great. I'm especially looking forward to
talk "Offline Password Cracking + Training Your Cat to do Tricks"
The conf, over Slack and stream, is scheduled for Sunday
https://pancakescon.com/2024-conference-information/

2024-03-21 15:18:51

A newly discovered vulnerability baked into Apple’s M-series of chips allows attackers to extract secret keys from Macs when they perform widely used cryptographic operations, academic researchers have revealed in a paper published Thursday.
The flaw—a side channel allowing end-to-end key extractions when Apple chips run implementations of widely used cryptographic protocols—can’t be patched directly because it stems from the microarchitectural design of the silicon itself. Instead, it can only be mitigated by building defenses into third-party cryptographic software that could drastically degrade M-series performance when executing cryptographic operations, particularly on the earlier M1 and M2 generations. The vulnerability can be exploited when the targeted cryptographic operation and the malicious application with normal user system privileges run on the same CPU cluster.
https://arstechnica.com/security/2024/03/hackers-can-extract-secret-encryption-keys-from-apples-mac-chips/